deploy.yml

name: deploy

on:
  workflow_run:
    workflows:
      - CI
    types:
      - completed
    branches:
      - main

permissions:
  id-token: write
  contents: read

env:
  AWS_REGION: ap-northeast-2
  ECR_REPOSITORY: ditda-notification-worker

concurrency:
  group: deploy-prod
  cancel-in-progress: false

jobs:
  build-and-deploy:
    if: >
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'push'

    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          persist-credentials: false

      - name: Set up JDK 21
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654   # v5.2.0
        with:
          java-version: "21"
          distribution: "temurin"
          cache: "gradle"

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5    # v6.1.2
        with:
          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/DitdaWorkerGitHubDeployRole
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@fa648b43de3d4d023bcb3f89ed6940096949c419   # v2.1.5

      - name: Grant gradlew permission
        run: chmod +x gradlew

      - name: Build & push image with Jib
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}
        run: |
          ./gradlew jib \
            -Djib.to.image=${ECR_REGISTRY} \
            -Djib.to.tags=latest,${{ github.event.workflow_run.head_sha }}

      - name: Deploy to EC2 via SSM
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}/${{ env.ECR_REPOSITORY }}
          IMAGE_TAG: ${{ github.event.workflow_run.head_sha }}
        run: |
          COMMAND_ID=$(aws ssm send-command \
            --instance-ids "${{ secrets.EC2_INSTANCE_ID }}" \
            --document-name "AWS-RunShellScript" \
            --parameters "commands=[
              'curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/${{ github.event.workflow_run.head_sha }}/scripts/deploy.sh -o /tmp/deploy.sh',
              'chmod +x /tmp/deploy.sh',
              'export AWS_REGION=${{ env.AWS_REGION }}',
              'export ECR_REGISTRY=${ECR_REGISTRY}',
              'export IMAGE_TAG=${IMAGE_TAG}',
              'export GITHUB_REPO=${{ github.repository }}',
              'export COMMIT_SHA=${{ github.event.workflow_run.head_sha }}',
              'bash /tmp/deploy.sh'
            ]" \
            --timeout-seconds 600 \
            --query "Command.CommandId" \
            --output text)

          echo "Command ID: ${COMMAND_ID}"

          for i in {1..120}; do
            STATUS=$(aws ssm get-command-invocation \
              --command-id "${COMMAND_ID}" \
              --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
              --query "Status" --output text 2>/dev/null || echo "Pending")
            echo "Status: ${STATUS}"

            if [ "${STATUS}" = "Success" ]; then
              aws ssm get-command-invocation \
                --command-id "${COMMAND_ID}" \
                --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
                --query "StandardOutputContent" --output text
              exit 0
            elif [ "${STATUS}" = "Failed" ] || [ "${STATUS}" = "Cancelled" ] || [ "${STATUS}" = "TimedOut" ]; then
              echo "=== STDOUT ==="
              aws ssm get-command-invocation \
                --command-id "${COMMAND_ID}" \
                --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
                --query "StandardOutputContent" --output text
              echo "=== STDERR ==="
              aws ssm get-command-invocation \
                --command-id "${COMMAND_ID}" \
                --instance-id "${{ secrets.EC2_INSTANCE_ID }}" \
                --query "StandardErrorContent" --output text
              exit 1
            fi
            sleep 5
          done

          echo "❌ 타임아웃"
          exit 1

      - name: Send Discord notification on success
        if: success()
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
        run: |
          curl -H "Content-Type: application/json" \
            -d "{\"embeds\": [{\"title\": \"🚀 DITDA Notification Worker 배포 성공\", \"color\": 3066993, \"fields\": [{\"name\": \"Branch\", \"value\": \"${{ github.ref_name }}\", \"inline\": true}, {\"name\": \"Commit\", \"value\": \"\`${{ github.event.workflow_run.head_sha }}\`\", \"inline\": true}, {\"name\": \"Author\", \"value\": \"${{ github.actor }}\", \"inline\": true}], \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%S.000Z)\"}]}" \
            $DISCORD_WEBHOOK || true

      - name: Send Discord notification on failure
        if: failure()
        env:
          DISCORD_WEBHOOK: ${{ secrets.DISCORD_WEBHOOK_URL }}
        run: |
          curl -H "Content-Type: application/json" \
            -d "{\"embeds\": [{\"title\": \"❌ DITDA Notification Worker 배포 실패\", \"description\": \"GitHub Actions 로그 확인 필요\", \"color\": 15158332, \"fields\": [{\"name\": \"Branch\", \"value\": \"${{ github.ref_name }}\", \"inline\": true}, {\"name\": \"Commit\", \"value\": \"\`${{ github.event.workflow_run.head_sha }}\`\", \"inline\": true}, {\"name\": \"Author\", \"value\": \"${{ github.actor }}\", \"inline\": true}, {\"name\": \"Run\", \"value\": \"[로그 보기](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})\", \"inline\": false}], \"timestamp\": \"$(date -u +%Y-%m-%dT%H:%M:%S.000Z)\"}]}" \
            $DISCORD_WEBHOOK || true